What is the first step when preparing for a computer forensic investigation?

seenagapeNovember 9, 2016

What is the First Step required in preparing a computer for forensics investigation?

A.
Secure any relevant media

B.
Suspend automated document destruction and recycling policies that may pertain to any
relevant media or users at Issue

C.
Identify the type of data you are seeking, the Information you are looking for, and the urgency
level of the examination

D.
Do not turn the computer off or on, run any programs, or attempt to access data on a computer

Show Answer

Digital forensics is the collection, assessment and presentation of evidence gathered from digital media. Digital evidence comes from computers, mobile phones and servers. Digital forensics helps solve complicated cases that rely on evidence from electronic devices.

The Power of Digital Forensics

Digital forensics helps investigative teams recover deleted data, discover evidence of misconduct and restore overwritten data. Digital analysts can mitigate damage, reverse system breakdowns and prove misuse of company property.

The Digital Forensic Process

The digital forensic process is intensive. First, investigators find evidence on electronic devices and save the data to a safe drive. Then, they analyze and document the information. Once it’s ready, they give the digital evidence to police to help solve a crime or present it in court to help convict a criminal.

The Nine Phases of Digital Forensics

There are nine steps that digital forensic specialists usually take while investigating digital evidence.

1. First Response

As soon as a security incident occurs and is reported, a digital forensic team jumps into action.

2. Search and Seizure

The team searches devices involved in the crime for evidence and data. Investigators seize the devices to make sure the perpetrators can’t continue to act.

3. Evidence Collection

After seizing the devices, professionals collect the data using forensic methods to handle the evidence.

4. Securing of the Evidence

Investigators store evidence in a safe environment. In the secure space, the data can be authenticated and proved to be accurate and accessible.

5. Data Acquisition

The forensic team retrieves electronically stored information (ESI) from the devices. Professionals must use proper procedure and care to avoid altering the data and sacrificing the integrity of the evidence.

6. Data Analysis

Team members sort and examine the authenticated ESI to identify and convert data that is useful in court.

7. Evidence Assessment

Once ESI is identified as evidence, investigators assess it in relation to the security incident. This phase is about relating the data gathered directly to the case.

8. Documentation and Reporting

This phase happens once the initial criminal investigation is done. Team members report and document data and evidence in accordance with the court of law.

9. Expert Witness Testimony

An expert witness is a professional who works in a field related to the case. The expert witness affirms that the data is useful as evidence and presents it in court.

The Digital Forensic Toolbox

Since almost the entire digital forensic process takes place on electronic devices, the forensic team should have the best software for the job. The following tools are programs and processes that help digital investigators find data legally and extract it safely.

The Sleuth Kit allows forensic specialists to utilize a collection of command-line tools, access a C library, and analyze disk images and recover files.

Volatility allows forensic specialists to rapidly list kernel modules from an 80GB system, perform virtual machine introspection and use a customizable web interface.

Cellebrite UFED (Universal Forensic Extraction Device) allows forensic specialists to employ data collection capabilities in the lab, at a remote location and in the field; retrieve cloud tokens and app data; and overcome mobile encryption challenges and password/PIN locks.

Medusa allows forensic specialists to use multiple services that allow remote authentication, explore a supported list of services for brute-forcing and save its service module as a .mod file.

Hashcat allows forensic specialists to test mixed device types within one system, use distributed cracking networks and conduct automatic performance tuning.

Webinspect allows forensic specialists to test the dynamic behavior of web applications for security vulnerabilities; conduct simultaneous crawl testing at various levels, from professional to novice; and use centralized program management features.

Skills and Certifications

Having the tools is only half the job. Forensic investigators must also know how to use them properly. Necessary skills include countering anti-forensic techniques, understanding system forensics, navigating file systems and hard disks, and investigating email crimes.

These professionals can also benefit from earning certifications. For example, Global Information Assurance Certification (GIAC), such as GIAC Certified Forensic Examiner and GIAC Response and Industrial Defense, is well-respected in the field. AccessData and the International Association of Computer Investigative Specialists also offer certifications and courses that can boost a forensic investigator’s career.

Digital Forever

As our world becomes more digital, cybercrime becomes more common. Forensic investigators help fight these crimes by gathering data and assessing it. They are first responders, data analysts and expert witnesses. As such, the digital forensic process is critical to both solving crimes and convicting criminals.

What is the first step in a computer forensics investigation?

What is the first step required in preparing a computer for forensics investigation quizlet?

What is the first step in the development of computer forensic capabilities?

What are the five steps in the computer forensics process?